Cyberattack: Platform used by schools in Kansas, nationwide as finals loom

A cyberattack on Instructure’s Canvas platform left thousands of schools and universities offline on May 9, causing disruptions as students prepared for finals. The hacking group ShinyHunters claimed responsibility, stating nearly 9,000 institutions worldwide were affected, with access to billions of private messages and records. The group began threatening to leak the data on May 9, with a second deadline set for May 12, suggesting negotiations over extortion payments were still underway. Canvas, used for managing grades, assignments, and course materials, was inaccessible for users across the U.S., including the University of Iowa, Virginia Tech, and Harvard. The University of Iowa called the incident a national-level cybersecurity breach, while Virginia Tech acknowledged disruptions to final exams. Schools like Spokane Public Schools reassured parents that no sensitive data had been exposed. The attack mirrors a previous breach on PowerSchool, another education-focused platform, where a Massachusetts college student was charged. ShinyHunters, described as a loose group of teenagers and young adults based in the U.S. and U.K., has also targeted Ticketmaster’s Live Nation subsidiary. Instructure has not yet issued a public statement regarding the incident. Universities and school districts quickly notified students and parents about the outage. Harvard’s student newspaper confirmed the system was down, and officials in Spokane, Washington, stated they were unaware of any sensitive data being compromised. The attack highlights the growing vulnerability of education systems to cyber threats as digital infrastructure becomes increasingly critical.